ML query

Elastic Stack Elasticsearch
1

Is it possible to do an ML job that says

If event.code: 4264 and 4265 within 30 minutes ?

2

Don't really need ML here. Why not just do this with a Watch, or an EQL query?

3

Its for SIEM, I would like a detection to go off if a single account is enabled / disabled within a short time .

I need the Over field

4

Yes, and in the SIEM v7.10 you can create a detection on an EQL query:

https://www.elastic.co/guide/en/security/7.10/rules-ui-create.html#create-eql-rule

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.